Apply current exponential de Finetti theorem to realistic quantum key distribution 
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In the realistic quantum key distribution (QKD), Alice and Bob respectively get a quantum 
state from an unknown channel, whose dimension may be unknown. However, while discussing the 
security, sometime we need to know exact dimension, since current exponential de Finetti theorem, 
crucial to the information-theoretical security proof, is deeply related with the dimension and can 
only be applied to finite dimensional case. Here we address this problem in detail. We show that 
if POVM elements corresponding to Alice and Bob's measured results can be well described in a 
finite dimensional subspace with sufficiently small error, then dimensions of Alice and Bob's states 
can be almost regarded as finite. Since the security is well defined by the smooth entropy, which 
is continuous with the density matrix, the small error of state actually means small change of 
security. Then the security of unknown-dimensional system can be solved. Finally we prove that 
for heterodyne detection continuous variable QKD and differential phase shift QKD, the collective 
attack is optimal under the infinite key size case. 



PACS numbers: 03.67.Dd,03.67.Hk 



I. INTRODUCTION: 

Information-theoretical security proof py] is a powerful 
and general way to prove the security for quantum key 
distribution (QKD). In this method, to give the amount 
of unconditional secret keys, we only need to discuss up- 
per or lower bounds of some entropies. The exponential 
de Finetti theorem is crucial to this method, which sup- 
port that as the key size goes to infinite, Eve cannot get 
more information from the coherent attack than from the 
collective attack [IJ . Since in the collective attack Eve at- 
tacks each signal independently with the same method, 
it is much easy for us to discuss the security. However, 
current exponential de Finetti theorem relying on the di- 
mension and even diverges if the dimension is infinite, 
while in practice the dimension is often unknown or infi- 
nite. 

There are also some other kind of quantum de Finetti 
theorems. In Ref. several de Finetti theorems for 

different conditions are given. These de Finetti theorems 
can be independent with the dimension. Even under the 
infinite dimensional case, they still converge. However, 
These de Finetti theorems are polynomial and not ex- 
ponential. As the key size goes to infinite, they can not 
exponentially converge to zero. Whether such polyno- 
mial de Finetti theorems can be applied to QKD requires 
further discussion. 

We can think about a more general case. Alice and Bob 
respectively get a quantum state from a channel and do 
measurement and thus hold classical data finally. Real- 
istically, they only know the classical data and do not 
know anything about the dimension of quantum state 
beforehand. Therefore, it is not realistic for us to as- 
sume the dimension before discussing the security. If the 
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dimension of quantum state is unknown, current expo- 
nential de Finetti theorem may not be directly applied 
and the security against the most general attack is diffi- 
cult to given by the information-theoretical method. In 
Ref. @, Renner gave some concrete examples to show 
the de Finetti theorem. From these examples we can 
see that if the dimension of individual quantum state 
is higher than the block size, the whole state may be 
far away from an almost i.i.d. state. For some QKDs, 
the dimension problem can be solved by introducing the 
squashing model [1, 0] ■ However for some other protocols 
we do not know whether there exist a squashing model, 
i.e. continuous variable (CV) QKD [§, '9] and differen- 
tial phase shift (DPS) QKD 10]. Then, it is necessary 
for Alice and Bob to get some information about their 
dimensions. 

Here we give a general way to estimate the effective 
dimension (In the following we will see that Alice and 
Bob's measurement data are obtained almost only from 
a finite dimensional subspace. Here we call the dimen- 
sion of this subspace as effective dimension.) of a system, 
and a general method to apply current information theo- 
retical security proof to practical QKD. Finally we prove 
that if POVM elements corresponding to Alice and Bob's 
measured results can be well described in a finite dimen- 
sional subspace with sufficiently small error, the security 
of unknown dimensional system is very close to that of a 
finite dimensional system, where Alice and Bob put finite 
dimensional filters before their detectors. The security of 
this finite dimensional system is covered by current in- 
formation theoretical security proof method. Then the 
security of unknown-dimensional system can be solved. 
Our solution is based on the estimation of the effective 
dimension of a system. In Ref. [ll|, Wehner et al. gave 
an estimation to the lower bound of the dimension of a 
system. We hope future works can shrink the gap be- 
tween these two results. Up to now, some efforts have 
been done for the finite key size case [H, ■ The se- 
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curity under finite key size case may be much different 
from tfiat under infinite key size case. To give a better 
result for finite key size case, it is necessary to give a tight 
estimation to the effective dimension. 

We may think that the world is always finite, so re- 
gard it as guaranteed that current exponential de Finetti 
theorem can be directly applied to practical system. It is 
not necessary the case. Firstly, finite measurement result 
does not always mean finite dimensional quantum state. 
A finite measurement result can also be generated from 
an infinite quantum state. Secondly, to know the upper 
bound of the dimension of quantum state is required if 
we consider the finite key size case. From the Ref. [ij 
we know that the amount of secret key rate under the 
finite key size case is deeply related with the dimension. 
Our estimation of effective dimension is expected to be 
favorable to finite key size situation. 

We noted two parallel works shown in Ref. [H, [lB| . In 
these two works, the unconditional security of CVQKD 
is addressed. In Ref. [14|, Renner et al. modified pre- 



vious exponential de Finetti theorem and this new theo- 
rem can be directly applied to CVQKD. From this new 
de Finetti theorem we can see that in CVQKD if the 
variance of Bob's measurement result is finite, the state 
Alice, Bob and Eve share can still be approximated by 
an almost i.i.d. state. Our result only works for hetero- 
dyne CVQKD and requires the maximum value of Al- 
ice and Bob's heterodyne detection to be finite. Under 
the infinite key size case, our result can give the same 
approximation that the state describes the whole infi- 
nite communications can be approximated by an almost 
product state with arbitrarily small error. In Ref. p^ . 
Leverrier et al. directly addressed the unconditional se- 
curity of CVQKD without the de Finetti theorem. Their 
work is based on the Gaussian optimality. In this paper 
we approximate the CVQKD by a finite dimension pro- 
tocol. The security of finite dimension protocol can be 
covered by current information theoretical security proof. 
Then the unconditional security of CVQKD is possible 
to prove. Compared with these two works, one advan- 
tage of our work is its application to photon number de- 
tection protocols, e.g. another coherent state protocol, 
DPSQKD. In the following, we will demonstrate how to 
apply our result to DPSQKD. 

The basic idea of our approach is as following. Al- 
though the dimension of quantum state Alice, Bob and 
Eve initially share is totally unknown, after obtaining 
measurement results, Alice and Bob collapse Eve's state 
into a less complex state and can know some information 
about the effective dimension of their state. Then we 
can construct another finite dimensional protocol, where 
Alice and Bob put a finite dimensional filter right be- 
fore their detection equipments that can filter out high 
dimensional components. We prove that final state of 
this new finite dimensional protocol is only slightly dif- 
ferent from the original one. Then the security of that 
unknown-dimensional protocol can be approximated by 
this new protocol. The security of this new finite dimen- 



sional protocol is covered by Ref. then the security 
of that unknown-dimensional protocol can be solved. 

In the following we will introduce a general QKD 
protocol at first and then discuss unknown-dimensional 
problem. Latter we will introduce a finite dimensional 
protocol and prove that if components of POVM ele- 
ments corresponding to Alice and Bob's measured results 
on high dimensional bases are small enough then the se- 
curity of original unknown-dimensional protocol can be 
well approximated by this finite dimensional protocol. 
While discussing their difference, we will introduce an 
entanglement version measurement to describe Alice and 
Bob's detection. Finally some application examples will 
be given. In application examples, we will only discuss 
the infinite key size case, while our result is also useful 
under the finite key size case. 



II. PROTOCOL: 

Here we limit our analysis to the following protocol. 

Alice and Bob take N quantum states from a chan- 
nel respectively. Then they permute their subsystem 
according to a commonly chosen random permutation. 
They separate N states into I blocks and perform POVM 
measurement to each state. Without loss of general- 
ity, we assume Alice and Bob respectively hold several 
POVMs, M^' = {M^'} and M^' = {My."} {i = 1, --J), 
where a;* and denote corresponding measurement re- 
sults, and they perform the POVM M-^* = {M^*} and 
]\,fBi _ ^y^q blocks (we assume the choice of 

POVMs is publicly known). Then they publish measure- 
ment results from the first block to estimate the channel. 
Before the classical procedure they estimate the dimen- 
sion of their quantum state according to the region of 
their measurement results. Then they give up partial of 
their measurement results (required by the information- 
theoretical security proof fl]) and finally obtain classical 
strings. After performing data processing, information 
reconciliation and privacy amplification, they finally gen- 
erate secret keys. Here, we allow Alice and Bob to hold 
several POVMs, mainly because in many QKD protocols, 
Alice and Bob need to randomly change their measure- 
ment bases. One POVM corresponds to one choice of 
bases. 

From current de Finetti theorem we know that if the 
dimension of the channel is finite, the state Alice, Bob 
and Eve share after many communications is close to an 
almost product state. It has been shown that such al- 
most product state almost has the same property with 
the product state. The product state corresponds to the 
collective attack. Then we only need to consider collec- 
tive attack jlj. However, if the dimension is infinite, the 
de Finetti theorem may diverge. Then we cannot know 
the difference between collective attack and coherent at- 
tack. 

We assume after getting quantum state, Alice, Bob and 
Eve share the state pj^N gN . Since discarding subsys- 
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tern never increases mutual information, we can safely 
assume that Eve holds the purification of Pj^N , so 
that pj^NgN^N is pure [J, H, After measuring all 

N states, Alice and Bob know the region of their mea- 
surement results. For example, in DPSQKD [10], if they 
use photon number resolving detector, they can know the 
maximum photon number they received from one pulse. 
In CVQKD 9] with heterodyne detection, they can know 
the maximum amplitude they get. Here, we will show 
that such information is enough for Alice and Bob to 
know whether their system can be approximated by a 
finite dimensional system. 

Alice and Bob can make an initial estimation to their 
state according to measurement results. After Alice and 
Bob knows the region of their measurement results, they 
can only consider such Pa^ b'^ that can generate their 
measured results with probability higher than certain 
small parameter e. Then the collection of states they 
need to consider is largely reduced. The insecure proba- 
bility introduced by such method is no larger than e and 
the strength of security will be reduced by e [r?|. This 
procedure is required by our proof. 

More precisely, we assume Alice and Bob's measure- 
ment results from a single state of i-th block belong to 
the region S(A'') and S(F') respectively. We let 

Then and D^' actually are POVM elements that 
correspond to Alice and Bob's measurement results be- 
longing to the region S(X') and S(F*) respectively. D^^ 
(D^*) may be different for different blocks. To avoid dis- 
tinguishing different D^^s (-D^*s), here we define POVM 
elements, D"^ and satisfying that for arbitrary state 
p and i, we always have 

triD^p) >tr{D^'p) , , 

tr{D^p) > tr{D^'p) ^ ' 

To know the requirement given in Eq. ([T]) well, we can 
see some examples. It can be seen that = I is one 
trivial element that always satisfy Eq. ([1]). Also, if all 
D^^s are just the same, = D^^ is the one satisfying 
Eq. Furthermore, since for any i and arbitrary p, 

the expectation value of — D^^ and — D^^ are 
non-negative, — D^^ and — D^^ are non-negative 
operators. Therefore, if - D^^ and - L*^* are 
not zero, they are also valid POVM elements. Then 
{D^\b^-D^\I-b^} and {D^\ - I ^ D^} 
constitute a POVM respectively (It should be noted that 
/ may be an operation of an infinite dimensional space.). 
Here we define the POVM elements and mainly 
because the maximum value of measurement result of dif- 
ferent blocks may be different and then D^^s are not the 



same. Nevertheless, for most of current protocols, it is 
not difficult to find a tight and . For example, in 
the heterodyne detection CVQKD, Alice and Bob do not 
change the basis, so there are only two blocks, one used 
for parameter estimation, one used to generate secret 
keys. We assume at Alice's side the maximum value of 
one block is T/^^x i ^ g^^^ ^^iSit of the other is V^'^'^ ^ . Then 
D^' = T..^<vr-^M^} and D^^ = E.^^y..... 
Since Alice uses the same POVM for these two blocks, 
we have M^^ = M^?. If V^''''^ > V^'^'''^, we can choose 
= Ex»<y»-i which satisfies Eq. Q. Then 

f)A^ jjAi J o'and b^- D^^ = Y.vr-^<.^<vr-' ^^'^ 
which is a POVM element. In the DPSQKD, Bob also 
does not change his bases, so a similar result can be ob- 
tained. 

To analysis the security we can only consider the state 
that satisfies 

tr[{b^b^f^PA«B-E-] > e (2) 

while the final strength of security will be reduced by 
£, where and are properly chosen elements that 
satisfy Eq. ([1]). Then the collection of Pa'^b^e'^ 
need to consider is largely reduced. It can be seen that 
to shrink the collection of pa«b'^e"i we need to find 
tight and . In the following, we will see that this 
technique is required by our argument. 

After Alice and Bob's measurement, the state Alice, 
Bob and Eve hold becomes px^y^ e'^ i where X and 
Y are classical variable that can take the value a;* and 

and can be expressed by orthogonal quantum state 
'1]. Actually, the security of QKD system directly re- 
lated to the state pjfwyjv^w, rather than original state 
Pan BN EN ■ Therefore, if we can find a finite dimensional 
system that generates another state px^yN en very close 
to pxNyN EN , then the security of the original unknown 
system can be approximated by this finite dimensional 
system. 

Now we can compare two schemes as illustrated in Fig. 
[T] One is the original unknown-dimensional scheme, and 
the other is a modified scheme, in which Alice and Bob 
respectively put filters before their detectors. We assume 
these two filters can totally filter out high dimensional 
component of received state and dimensions of output 
states of these two filters are (Ia and respectively. For 
convenience, we will call the original protocol as protocol 
1 and the modified one as protocol 2. Then in the proto- 
col 2 dimensions of Alice and Bob's received states are dA 
and ds respectively. In the following, we will see that if 
we properly set the filter and choose high enough dA and 
ds, then the security of protocol 1 can be approximated 
by that of protocol 2. 

To simplify our discussion, it is necessary to avoid dis- 
tinguishing different blocks. We know that D^~D^^ and 

f)B _ JJB^ 

are also POVM elements. Here we introduce 
other two classical data x'* and y'* that correspond to 
POVM elements - D^' and - D^' respectively. 
Then in protocol 1 Alice and Bob's measurement results 
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Protocol 1 




Filter 



FIG. 1: Illustration of protocol 1 and protocol 2, where in pro- 
tocol 2 finite dimensional filters are put before the detectors. 
If the filters are properly chosen, the security of protocol f can 
be well approximated by that of protocol 2, while the security 
of protocol 2 is covered by current information theoretical se- 
curity proof method. The exact difference between protocol 1 
and protocol 2 becomes significant while we consider the the 
finite key size case. 



of i-th block are within the region S(X') U {x'*} and 
U {y'^} respectively. Therefore, this protocol does 
not change if it runs as follows. While getting measure- 
ment results from a state of i-th block, Alice and Bob ac- 
cept them only when they belong to region U {a;'*} 
and S(y*) U {y"} respectively. Otherwise, they discard 
them. Now we can calculate the difference between the 
protocol 1 and the protocol 2. 



III. ESTIMATION OF ii-DISTANCE BASED 
ON OBSERVATIONS: 



tector, which directly gives her the classical data. After 
reading out the classical data, Alice set the detector and 
environment to the initial state to do the next measure- 
ment. In this model we require initial states of Alice's 
detector and environment are pure and respectively to 
be \de)A and |Env)yi. For convenience, here we let \ini)A 
denote |de)A|Env)yii. Then the interaction among the re- 
ceived state, detector and environment for i-th block can 
be given by 



(3) 



where |a;*)s are orthogonal states of detector, IQ^i) de- 
scribes orthogonal state of the environment, {ini\ denotes 
the initial pure state of Alice's detector and environment 

and 



/M^* is the POVM operators corresponding to 

POVM element M^' To check the validity of this 

measurement, we can apply it to a two parties system 
PAB- After the interaction described by U\, the state of 
whole system becomes 



Pabxq^ 



UaPab ® \ini) AiinilWj^ 



= Y.W)\Q,.)^M^+pAB 



X3 



M 



A] 



where Qx denotes the environment and all of \Q.j.i)ii are 
orthogonal with each other. After we trace out the sys- 
tem A and environment we immediately obtain the state 



PXB = ® tTAi^M^^+pABjM,^ 



rAi\ 



We see that 



trAi^M^^PAB^M^n = P{x^)p^B 

where P{x^) is the probability of the out come and 
p^ denotes Bob's conditional state while Alice's mea- 
surement result is x*. Then pxB becomes 



Before calculating the difference, here we introduce a 
entanglement version measurement. There are several 
interpretations for the quantum measurement, e.g. von 
Neumann measurement scheme and Many-worlds inter- 
pretation [l^ . Here we are not to give a new philosophi- 
cal interpretation, but to construct a physical model that 
can effectively perform POVM measurement. This phys- 
ical model allows us to easily find the difference between 
protocol 1 and protocol 2. For briefness, here we only 
take Alice's measurement as an example. Alice's POVM 
measurement can be performed by the equipment shown 
in Fig. [2] The measurement procedure is realized by an 
interaction among her received state, detector and the en- 
vironment. After the interaction, Alice gives up received 
state and the environment and thus only holds the de- 



which consists with the POVM measurement. Since Alice 
only accept the data within the collection S(X') U {x'*}, 
we can reduce the unitary transformation given in Eq. [3] 
to a general quantum operation 0\ to describe Alice's 
effective measurement, which is given by 



W)\Qx^)A(^n^\ 

x'eE(X')u{x''} 



M 



Ai 



(4) 



Here we can see that 0\ may not be a unitary transfor- 
mation. The quantum operation that describes Alice's 
total N detection is 



O 



AN 



(5) 
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FIG. 2: Illustration of entanglement version measurement, 
where |Env) and \de) respectively denote the initial state of 
environment and the detector. The measurement can be real- 
ized by the unitary operation among received state, detector 
and the environment. After the operation, the received state 
and the environment are given up and the measurement re- 
sult can be directly given by the state of detector, denoted by 
px- 



where rii denotes the length of i-th block. By the same 
way we can give the operator describing Bob's whole TV 
detections (By substituting the notation A by B.). 

Since we only need to consider the case that Pa'^ b'^e" 
is pure, here we assume the initial state Alice and Bob 
receive is I^'^n^n^jjv). The initial state of Alice and 
Bob's detector and environment is |^'x™y"q™q~) = 
\ini) A\i'ni) B ■ Then for the protocol- 1, after Alice and 
Bob's measurement (general quantum operation [l^) the 
state describing Alice, Bob, Eve, detectors and environ- 
ment becomes 



I* 



P-ii 



= I* 



XJVyJV^WBJVQNQN^Jv; 



(6) 



where X and Y denotes Alice and Bob's detectors, Qx 
and Qy denote the environment around Alice and Bob, 
O^N is the operator describing Bob's whole N detections 
and (O^jv (^^jv Oyijv O^jv ) describes expectation value of 

^A" Obn . 

In protocol-2 Alice and Bob respectively put a (Ia and 
dB dimensional filter before their detectors. The filter 
can be described by a projection into a subspace. Here we 
let the projector P^'* and P^^ denotes Ahce and Bob's 
filters. For convenience we let Pa^" denotes P'^^^Pg'' . 
Then for the protocol-2 after Alice and Bob's measure- 
ment the whole state becomes 



^{{P^-/-)^N 0+^0+^0 A- Ob^pI^b'^'''') 

After tracing out received quantum state A^ and , 
and the environment and Qy we obtain the state 



Alice, Bob and Eve finally hold. For the protocol-1, they 
finally hold the state px^y'^E'^ ^^'^ fo'' the protocol-2, 
they finally share px^Y" e" ■ If we know the Li distance 
between px^yNBt^ and pxNy'^E^ we can know the dif- 
ference between securities of protocol-1 and protocol-2 
[l[. Since tracing out the subsystem never increases the 
Li distance the Li distance between px^yN^^ and 
PxNyN^N is no larger than that between I^Pp-i) and 
|*p-2)- We know that 



I* 



A'^B"E"/ 



(8) 



{Pl%'n'^''\'^A-B-E-) + {Plj^'n^^^'l^A-B-E- 



where P denotes the orthogonal complement space of P. 
By putting the Eq. ([8|) into Eq. ([6]) we quickly know 



|*p-i> 



al^'p- 



P-2 



where 



(Oj^jv O^nOanObn) 



(9) 



and 



I*') = 



4^%'^ r^o^, o+„ 6 AN Obn {p%^-r^) 

is a state obtained from the complimentary space 

{Pab")®^, which may not be orthogonal with |*p-2). 
From the Appendix- A of Ref. pi] we know that the Li 
distance of two pure state and [^'2) can be given by 



lllvl/i) - \^^)\\ = 2Vl-|(*i|*2)P 

where 1 1 • 1 1 denotes the Li distance. Then the Li distance 
between \^p-i) and |^'p_2) is no larger than 2|/3|, which 
yields 

I JVyN £JV — pxNyN BN II ^ 2|/3| 

For convenience here we let D = D^D^ . If we put 
Eqs. ([4]) and (O into Eq. ([9]) and apply the fact that 
operators of different detectors are commutate, we can 
know that 



trABE[D'^''iPl^/^)'^^PA-B-E-{PlB''n'^n 
tTABE[D^''p A^^ B'^ E'^\ 



(10) 

Now we can see that if all of pure state pa^^ b'^ e'^ satis- 
fying Eq. ^ make small enough, then protocol-1 can 
be well approximated by protocol-2. 

To estimate |/3| here we give a very useful theorem. 

Theorem 1 Let \1)a, \2)a, and \1)b, \2)b, 
he bases of Alice and Boh 's Hilhert spaces respec- 
tively, by which projectors P^"^ 



tively given hy P'^ 



cLa 

A 



and Pg^ can he respec- 
|1)a(1| + ... + \dA)A{dA\ and 
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P«B = |1)b(1| + ... + \dB)B{dB\- Then if we have 

YZ:Z=d. um''\j)A\ + T.T=Z=djBm''\3)B\<-i, 

for arbitrary Pa^b'^e^ ^■s always satisfied that 
trABlD'^'^JP^^PA^B^JP^n^] ■■=L<e\ 

Proof: We can see that L is no larger than 
niax|.tiv)(*^|l)®^|*^), where |*^) € Jp^^^)®^ . If 
we expand (^-^IL)®^]*^) = 

into product spaces ^(P^-^)^^-i(P^^)®^, 
and do straightforward calculation, we can imme- 
diately find that L < N[j:TjZ=dA \A{i\D^\j)A\ + 

ETjZ=dn \B{i\D^\j)B\] < (The straightforward 

calculation is too bothering to show here. Detailed one 
can be seen in the appendix.) □ 

Since trABE[D^'^ Pa''' b''' e«] > e, from Eq. (fTO|) . we 
can see that Theorem 1 actually gives a sufficient condi- 
tion for < e. 

Now, we can know the distance between protocol I 
and protocol 2 from the measurement results. The only 
remained problem is to give the difference between secu- 
rities of protocol- 1 and protocol-2 if the state difference 
of them is known. 

Theorem 2 // ||pjs:«f«e« ~ Px«y«_B«ll ^ 2(5 for all 

Panb^^e^ satisfying tr[{D'^ D^)®'^ Pan bn e^^] ^ ^) then 
the b5 + e-secure secret key rate of protocol-1 is no less 
than the 25 + e-secure secret key rate of protocol-2, while 
Alice and Bob take results from protocol-1 as that from 
protocol-2 to estimate the secret key rate of protocol-2 by 
the information theoretical method. 

Proof: The Li distance cannot be increased by quan- 
tum operations and thus classical bit-wise processing [l| . 
If I ~ Px™F™£;" II ^ 2(5, then we have | {pxi'S ~ 

Px^bII < 2(5 and \ \px''^Y" ~ Px"y" II < 2(5, where X'', 
and E denote Alice and Bob's classical data and Eve's 
state after the data processing respectively, during which 
some information maybe announced. The security is well 
defined by smooth min- and max-entropies. The amount 
of e-secure secret keys can be given by ^^min(Px'=£;l'^) ~ 
leakjfi [igj , while the strength of parameter estimation 
is e'", where H^ini'l ) denotes the smooth min-entropy, 
leakjfi denotes the amount of information published dur- 
ing the e"-secure reconciliation and e' -I- e" -I- e'" = e [l| . 
Since Hpx^g — Px^ijll < 2(5, the smooth min-entropy 
satisfies H'J+'{px.e\E) > H^nuniPx^slE) Q. Also, if 
Alice and Bob use the data from the protocol-1 as that 
from the protocol-2 to estimate the state of protocol-2, 
the security of the parameter estimation [ij will be re- 
duced by 26, because ||/Cx"y" ~ Px"y"II ^ 2(5. Fur- 
thermore, if we only consider the pa^b^e" satisfying 
tr[{D^D^)'^^ Pan Bf^ Ei^] > S, the strength of security 
will also be reduced by 6. In all, the e' -I- e" -|- e'" secure 
security of protocol 2 is given by H^-^{p-^^^\E) — leakiR, 
while the strength of parameter estimation is e'" and 
the PxkB is estimated by the data obtained from pro- 
tocol 2. The e' -\- e" -I- e'" -\- 26 secure security of pro- 
tocol 2 is given by H^^^{p-^^^\E) — leakjji, while the 



strength of parameter estimation is e'" -\- 26, where the 
PxkB estimated by data obtained from protocol 1. 
Finally the e' + e" + e'" + 56 secure secret key rate of 
protocol 1 can be given by H^-'^'^ {Px''e\E) — leakjB. > 
-^min(/°x'=i!;l ) ~ whilc the strength of parameter 

estimation is e'" -f 26, the state Px^e estimated by the 
data obtained from protocol 1 and only the Pa^b^en 
satisfying tr[{D^D^)^^ pan b" e^] > <5 is considered. 
Here the term H^-^^{p-^^j^\E) — leakjn is amount of the 
e' -|- e" -|- e'" -\- 26 secure secrete keys of protocol 2, while 
the strength of parameter estimation is e'" -I- 26, where 
26 comes from the fact that the state Pxh^ estimated 
by the data obtained from protocol 1. □ 

The state distance Wpxnynen — Pxnyn en || < 2(5 can 
be evaluated from the measurement results through the- 
orem 1. The security of protocol 2 is covered by current 
information theoretical security proof method. Then the 
the security of protocol 1 can be solved. 



IV. SECURITY OF PROTOCOL 2. 

If Alice and Bob's received initial state in protocol 
1 is Pan bn , the state they received in protocol 2 is 
PANBN = where i is 

introduced for normalization. After quantum commu- 
nication, Alice and Bob will permute their state, then 
Pan BN is permutation invariant. The projection oper- 
ator (P^;^'^^)'^^ commutates with the permutation op- 
erator, so Panbn is also a permutation invariant state. 
The dimension of individual state of Panbn is dAdB- 
Then there is a symmetric purification for Pan b" ^ 
Hilbert space of dimension {dAdBY^ , which actually is 
Panbn EN [H, [20| . Then the dimension of the individ- 
ual state of Pa'^b''^e'^ is (dAdB)^- According to current 
exponential de Finetti theorem, the state Panbn en is 
close to an almost product state [2T'|. Then we can only 
consider the collective attack. Since under the collective 
attack. Eve attacks all of signals independently by the 
same method, here we let pabe denotes the state Alice, 
Bob and Eve share after a single communication. Be- 
fore calculating the secret key rate, we need to estimate 
possible PABE from measurement results. It should be 
noted that although pabe belongs to a Hilbert space of 
dimension (dAdB)^, we do not really need to estimate it 
only in a (dAdB)^ dimensional subspace. We can still 
construct it in an infinite dimensional space, because a 
state belonging to a ((i^c^s)^ dimensional Hilbert s pac e 
also belongs to a infinite dimensional Hilbert space [23 |. 
This point shows that while we discuss the collective at- 
tack for protocol 2, we do not need to take the filter in 
to account. If we give up filters in protocol 2, the pro- 
tocol 2 becomes the same as protocol 1. Then if we do 
not take the filter into account, the security against col- 
lective attack of protocol 2 is actually equivalent to that 
of protocol 1. Finally, our conclusion is as follows. The 
security of protocol 1 can be approximated by that of 
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protocol 2. For the protocol 2 we only need to consider 
the collective attack. While the Hilbert space of protocol 
2 is only a subspace of protocol 1, then the secrete key 
rate of protocol 2 against collective attack is no less than 
that of protocol 1 against collective attack. Finally, we 
actually give the difference between coherent attack and 
collective attack for protocol 1. We introduce the filter 
only to apply current de Finetti theorem and to give the 
difference between coherent attack and collective attack 
for protocol f . 

The 5(5 + e-secure unconditional secret key rate of 
protocol- 1 is no less than the 25 + e-secure secret key 
rate of protocol-2. Under the infinite key size case, the 
unconditional secrete key rate of protocol 2 is given by 
the secret key rate against collective attacks (ij . The se- 
cret key rate under collective attack of protocol 2 is no 
less than that of protocol 1. Also under the infinite key 
size case, the parameter e can approach to zero. Then 
the 5(5-secure unconditional secret key rate of protocol-1 
is no less than the 26 secure unconditional secret key rate 
of protocol-2 and no less than its secret key rate against 
collective attacks, where 2S comes from the fact that Al- 
ice and Bob use the data of protocol 1 to estimate the 
state of protocol 2. In addition, under the infinite key 
size case, we may choose large enough and ds so as 
to make ^approach to zero. Then we can directly say 
that for protocol 1 if the POVM elements corresponding 
to the measured results can be arbitrarily well described 
in a finite dimensional space, the collective attack is op- 
timal under the infinite key size case. 

For many practical QKDs, the projection of POVM 
elements of measured results on high dimensional basis 
is extremely small. For example, the POVM element for 
heterodyne detection corresponding to measured result 
(p, q) is Mp^q = + iq){p + iq\, whose component on 
the photon number basis |m) exponentially goes to zero 
as m increase. The POVM of inefficient photon number 
resolving detector i23] also has similar property. Then 
if a QKD protocol utilize such detectors, Alice and Bob 
can announce the maximum + or maximum photon 
number received from one pulse. Then Alice and Bob 

3 

can construct the big POVM D and for a given ^ they 
can find a big enough d (smaller than N) that in photon 

number picture satisfies X^i^'i^^d — W- Then 

the difference between states of protocol 1 and protocol 2 
can be smaller than 2e. The 5£ -I- e-secure secret key rate 
can be given by 2e + e-secure secret key rate of protocol 
2, which is covered by Ref. 



Here we give two application examples. We will see 
that our result can be readily used for heterodyne de- 
tection and photon number detection case. It should 
be noted that in the following we only proved that for 
CVQKD and DPSQKD the collective attack is optimal 
under infinite key size case. How to prove their security 
against collective attack has not been solved in this pa- 
per. For short, we only take the infinite key size case 
for examples. It seems that our estimation of effective 
dimension is meaningless under this case. However, we 
should note that under the finite key size case, the esti- 
mation of effective dimension will be useful. 



A. Unconditional security of CVQKD 

Now we apply our results to the heterodyne detection 
CVQKD and prove that as the key size goes to infinite 
the collective is optimal. In the prepare & measurement 
CVQKD, Alice prepare a continuous variable EPR pair, 
and sends one part to Bob. Alice and Bob respectively do 
heterodyne detection to their held states. The security of 
such scheme against collective attack is discussed in Ref. 
tOi]. Here, we prove that for this protocol the collective 
attack is optimal under the infinite key size case. We 
denote Alice and Bob's measurement result by (pA,qA) 
and {pB,qB) respectively. The corresponding POVM el- 
ements are respectively Mp^^g^ = - \pa + iq/d {pa + iqA\ 
and Mpg^q^ = i-\pQ + iqB){PB + igsl- In a realistic sys- 
tem, the maximum value of Alice and Bob's measure- 
ment results is finite (or Alice and Bob can give up some 
extremely larger measurement results). Then their fi- 
nal shared data is within certain region. We assume 
ymax ygiax large enough, so that for all pos- 
sible {pA,qA)s and {pB,qB)s Alice and Bob hold satisfy 
Pa + qA < ^a"'' and p% + ql < Vg"''' (or Alice and 
Bob only accept the data with amplitude no larger than 
Uf^'^ and U^^'^). Then we can construct I)^ and 
respectively to be 



TT 



1 



\PA + iqA){PA + iqA\dpAdqA 



\pb + iqB){PB + iqB\dpBdqB 



APPLICATIONS: 



The filter and P^^ can be chosen in photon number 
space. We let 



In the realistic case, the measured result is always fi- 
nite. In heterodyne detection protocols, the maximum 
value of measured result is limited. In photon number 
detection protocol, the maximum received photon num- 
ber is finite. Such realistic cases allow us readily apply 
our results. 



PT = |o)A(o| + |i>A(i| + ... + MA-i>A(dA-i| 

= |0)B(0| + |l)B(l| + ... + |dB-l)B(rfB-l| 

where and |j)_b(j| denote the photon number 

state. Now we utilize theorem 1 to discuss the difference 
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between protocol 1 and protocol 2. We see that 



E U(*l^^b->A| 



1 
TT 



E \A{i\PA + iqA) 
(pa + iqA\j) A\dpAdqA 



E ■ 

1=0 j=dA-l 



/oo ■ r 2 1 °° 7 

S^^,?r^ ^ 
where in the forth line we used the result that |A(i|pA H 



p\ + q\. Under 



the case that S> VX'*'*^' '^^ ^^e Stirling for- 

mula to approximate y^.. Then we have X^^d^ °^ 
(^a/-\/5a)''^, which exponentially goes to zero as in- 
creases. Then the whole term J2'i^o°j=dA U(*l-^'^b)'4l 
will exponentially go to zero with the increase of 
cIa- By the same way we can prove that the term 
J2'r^ij=dB \b {"110^^)31 will also exponentially goes to 
zero with the increase oi ds- Finally, for a given and 
large enough N, we can find a, dA N and <C -/V, 
that satisfy 



oo,oo 



oo,oo 

i=l,j=dA i=l,j=dE 



E \A{t\D^\j)A\ + 



\b{i\D''\j)b\ ■.= Err< - 



N 



Then from the theorem 1 and 2 we know that the secu- 
rity of this CVQKD scheme can be approximated by the 
security of a scheme of dimension (c?ac?s)'^ ^ N with 
errors no larger than 5e (Err exponentially approach to 
zero with the increase of c?a and ds, so that d^ and ds 
are proportional with log(iV/£'^). Then for large enough 
N, we can have (d^ds)^ ^ N). Then 5£-|-e-secure secret 
key rate of heterodyne detection CVQKD can be given 
by 2£ -I- e-secure secret key rate of protocol-2, where Al- 
ice and Bob respectively put filters P^^ and P^^ before 
their detectors. As iV ^ oo, we can find large enough 
{dAdsY that allow £ 0, and the security pa- 

rameter e can goes to zero From the Ref. we know 
that, under the case that (dyids)'^ ^ N oo, the col- 
lective attack is optimal for protocol 2 and its secret key 
rate can be given by that under collective attack. Since 
the secrete key rate against collective attack of protocol 
2 is no larger than that of protocol 1, under the infinite 
key size case the unconditional secret key rate of hetero- 
dyne detection CVQKD equal to its secret key rate un- 
der collective attacks and the collective is optimal. Here, 
we require Alice and Bob give up such data whose am- 
plitude is larger than V^^^^ and V^'^^. We can expect 
that for large Va'^^ and V]^^^, the proportion of given 



up data is extremely small. Such procedure only causes 
extremely small change of state, and thus only cause ex- 
tremely small change of security. On the other hand, 
a realistic security proof for CVQKD should take such 
cut off procedure into account. After all, in a realistic 
situation, the maximum value of measurement results is 
always finite. 



B. Unconditional security of DPSQKD 

Now we apply our result to coherent state DPSQKD, 
whose dimension is infinite in principle. Up to now, 
the security against collective attack for DPSQKD un- 
der noiseless case is proved [ld| . Here we show that that 
proof actually is unconditional security proof. To allow 
Alice and Bob do random permutation, in Ref. [13] Zhao 
et al. cut the long sequence of coherent states into blocks 
and regarded one block as one big state. Then Alice 
and Bob can permute these big states. In the DPSQKD 

Alice sends Bob a big state l^-^"") = (g) (de- 

1=1 

notes the state of a block) , according to her binary string 
X — {xi,X2, ■■■,XNb), where \{—l)^^~^^a) is a coherent 
state. Then Bob measures the phase difference between 
each two individual state. The collective attack means 
Eve attack these big states (blocks) independently with 
the same method. Here we require Bob use the pho- 
ton number resolving detector. After many rounds of 
quantum communications. Bob announces the maximum 
photon number received from one big state (one block). 
Then if Bob put a filter that filters out all the state whose 
photon number is larger than certain criteria, the mea- 
sured results should not change too much. 

We see that if the efficiency of photon number resolv- 
ing detector is 100%, then we can definitely know the 
actual dimension of Bob's received state. However, if 
that efficiency is not 100%, we cannot determine the ex- 
act dimension of Bob's state from the measured photon 
numbers. 

Here we discuss the imperfect detector case. In Ref. 
[13], the POVM element of ineffective photon number re- 
solving detector is given. In that reference, the spacial 
mode of received photon state has not been considered. If 
we take the spacial mode and other components into ac- 
count, we can extend that POVM element corresponding 
to n photons to be 



(12) 



where 7 denotes detector efficiency and Pm denotes the 
projector to m photon number subspace. We assume the 
dimension of m photon number subspace is /,„, and Pm 
to be 



(13) 



fe=l 
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where \<f^) denotes the orthogonal state of m photon 
number subspace. It can be prove that < lim + I — 
l)!/m!, where I denotes the block size. 

If Bob's maximum received photon number is rto, then 
the POVM element corresponding to this event can be 
given by 

n— nQ 

= E (14) 

n=0 

In DPSQKD, if the block size is I, the dimension of Alice's 
modulation is 2', which is finite. Therefore we only need 
to discuss Bob's state. We can construct Bob's filter to 
be 

rn— 7nn 
pdB _ p 

ni—0 

where Pm is given by Eq. p3p . Now we can use theo- 
rem 1 to estimate the difference between protocol 1 and 
protocol 2. We enumerate the basis of the filter by \(p]!^)- 
Then we have 

D^ff■.^ E mD^\v"k') (15) 

m—O.m'—rnQ.kjk' 

no 

n—0 m—mo 
"0 

-E^" E (l-7)'"""V^!(™ + ^- 1)'^""^ 

n—0 m—niQ 

where in the second line we have used Eqs. (fT2|) . (fTB]) and 
(fTi)) and the fact that fm < l{m + I — l)!/m! and in the 
third line we used the fact that m{m.— l)...{m — n) < m". 
It can be seen that Diff exponentially goes to zero as 
Too increases. Then for a given security parameter we 
can find a large enough key size N that gives the required 
security. 

It also can be seen that if Bob use the perfect photon 
number resolving detector or a detector that can given 
the upper bound of the number of received photons (e.g. 
bourn up if received photon number is too high), then 
they can find a protocol 2 that is exactly same as protocol 
1. Then we can immediately get a conclusion that the 
collective attack is optimal under the infinite key size 
case. 



VI. CONCLUSION: 

In the above we give a method to apply current expo- 
nential de Finetti theorem to realistic QKD. In realistic 
QKD, the number of Alice and Bob received photons is 
always finite and their measurement results always be- 
long to a finite region. This property allow us effectively 
describe the QKD protocol in a finite dimensional sub- 
space with sufficiently small error. In this paper, we in- 
troduce another finite dimensional protocol by putting 



finite dimensional filters before the detectors, and shown 
the security difference between the original unknown- 
dimensional protocol and this finite dimensional proto- 
col based on measurement results. Since the security of 
that finite dimensional protocol is covered by current in- 
formation theoretical security proof method, the security 
of a realistic unknown dimensional system can be solved. 
Our result can be used to prove the unconditional se- 
curity of heterodyne detection CVQKD and DPSQKD. 
Finally, we prove that for heterodyne detection CVQKD 
and DPSQKD collective attack is optimal under the infi- 
nite key size case. The difference between protocol 1 and 
protocol 2 will be meaningful if we consider the finite key 
size case. 
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APPENDIX A: DETAILED PROOF FOR 
THEOREM 1 

At first we can see that 

trAB[D^'^iPAB''n'^^PA^B«{PiB''^)^^] i s no larger 
than max|^iv)(*^|L'«5^|^'^) where 1^-^) e (P^^^'^^)®^. 
To find max|^«)(*^|i)^^|*^), we need to ex- 
pand the space (^p'^Ads-^^N ]-,y product spaces 

denote the projector to Alice's (Bob's) fc-th state. 
Also we distinguish bases of k-ih state of Alice (Bob) 
as |1)a.,|2)^_^., (|1)b,,|2)b,,...)^ We know that 

I A, = + Pj^ and Ib, = Pi: + P^:, where I a, and 
Ib^. are the identity matrixes corresponding to Alice and 
Bob's k-ih states. Then we have 

= + (*^|P^^^«^|*^) 

^C^F + Ci (Al) 

where Cp and C\ respectively denote the first and second 
term in the second line. Since 

P^ = Ma + I) A, {dA + l\ + \dA + 2)ai {dA + 2| + ... 
/a, = |1)a,(1| + |2)a,(2| + ... 

the C]p can be given by 

d = (*^|^^®^/aJ*^) (A2) 

CX2.00 

^ (TOil^^lmi). 

mi— dyi + l.m^ — 1 

(*^|mi)(^^)«^-i(^^)«5^(m'i|*^) 

where we have used the fact that Pf^ and Df" and are 

commutate if fc ^ j and and denote POVM ele- 
ments corresponding to j-th state. We know there exist 
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two pure states 1$^^) and |l>7') that can let (mil^-^) 
and (mi|*^) be written as {mi\^^) = Aij^^^) and 

(m'i|\E'^) = X[\^Th, where |Ai| < 1 and |Ai| < 1. Then 



Cp can be given by 



(A3) 



oo,oo 



Before giving the upper bound to Cp, we will discuss 

the upper bound of |($7'^|(L'^)®^-i(£)^)®^|l>™'i)|. It 
is known that arbitrary POVM element M can be written 
into a diagonal form. We assume an arbitrary Al can be 
written as 

M = ai\ipi){ipi\ + a2\(p2){'P2\ + ■■■ 

where \ipi), {^2), •■•are orthogonal bases, and ai, 02, ••• are 
positive real numbers and satisfy < 1. We let 
and IV'') are two arbitrary states. Now we consider the 
following value for [ip) and 

MMW)\ = \ai{^\vi){vM')+a2{^\v2}{V2W) + -I 
From the fact that 

Mv,)\' + m^2)\' + ... < 1 (A4) 

|(VVi>P + l(V^V2>P + - < 1 

we know that for arbitrary states jV') and \ tp') and POVM 
element M, it is always satisfied that 



|(V|M|^')I < v /|ai(^|y>i)P + |a2(V'|y2)P + ^..(A5) 

where in the first line we applied the Cauchy-Schwartz 
inequality which says that 

|ai6i + 0262 + •••I < 



VWi\^ + \a2\^ + -V\bi\^ + \b2\^ + - 

and in the second line we applied Eq. (|A4p and the fact 
that Oi < 1. 

Now we put Eq. (jASP into Eq. (|A3P and obtain 



where Cp and C| respectively denote the first and the 
second term in the second line. 

As the Cp, the Cp can be rewritten as 



00,00 

^ {m2\D^\m'2)- 
(*^|m2)P^fp^)^^-ip^)^^(TO^|*^|A7) 

Also there exist a pure state I'l'™^) which 
(vI'^|m2)P^:|^ can be written as A2($™^ | and a pure state 

I $2"^) by which (m2|^^) can be given by A2|$™^). Since 
|Ai| < 1 and IA2I < 1, from the Eqs. (|X5|l and jJ?! we 
know that 

00.00 

\Cl\< J2 \{m2\D^\m',)\ (A8) 
If we continuously do such procedure, we will find that 

27V 

^1*^) = ^C^ + C2^ (A9) 

1=1 

and 

00,00 

\Cf\< E (AlO) 

mj— + 1,771^ — 1 

for i < and 



|C>|< E IK|^^|m^)| (All) 



for i > N, where 



and we have appfied the fact t hat |^ ^) ejP^^'^^)^'^. 
Finally from Eqs. jAg]), (!A10P (jAlip and (|Al2p we can 
see that 



\CU< E l("^il^-'K>l (A6) 
By the same way Cp can be given by 



2N 



< ^|C>| (A13) 



00,00 



j = l,j = rfA 



i=l.j=dB 



Since Eq. (^13)) holds for arbitrary |*^) G , 
the Theorem 1 is proved. 
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